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The United States respectfully submits this brief for the Court's consideration. 

SUMMARY 

Investigations can be broken down into two general categories: criminal and 
administrative. Criminal investigations are concerned with discovering evidence and finding the 
individual responsible for the crime. Administrative investigations encompass fact finding 
inquiries. Both criminal and administrative investigations comprise searches for information to 
aid making factual determinations. Damage assessments, however, as multi-discipline, multi- 
agency, lengthy inquiries, consider the effects of compromised classified information to reach 
strategic opinions. 

DISCUSSION 

Criminal investigations seek to discover the perpetrator of the crime and assign liability. 
An inquiry becomes a criminal investigation when it is conducted with a view toward 
discovering evidence to be used in the prosecution of a criminal action. See United States v. 
Goldfinch, 41 C.M.R. 500, 507 (A.C.M.R. 1969) (determining that inclusion of CID 
participation at inception of a health and safety inspection turned the search into a criminal 
investigation concerned with prosecution). Williams also contemplates investigations being 
oriented towards discovery of the responsible individual. See United States v. Williams, 50 M.J. 
436, 443 (C.A.A.F. 1999) (stating that the Brady line of cases requires the prosecution to review 
records directly related to the subject of the prosecution absent a specific defense request 
identifying the entity, type of records, and type of information). Furthermore, Williams 
discusses criminal investigations in terms of proceedings designed to assign criminal liability. 
See United States v. Williams, 47 M.J. 621, 626 (A. Ct. Crim. App. 1997), affd, 50 M.J. 436 
(C.A.A.F. 1999) ("A trial counsel's duty to disclose . . . includes information which the trial 
counsel has personal knowledge of or is known to criminal investigators or others that are 
working on the case being investigated and prosecuted") (emphasis added). Ultimately, the fact 
finder reaches a factual determination based on the evidence gathered in the criminal 
investigation. United States v. Augspurger, 61 M.J. 189, 191 (C.A.A.F 2005). 

Administrative investigations are designed to find facts. See, e.g., U.S. Dep't of Army 
Reg. 15-6, Procedures for Investigating Officers and Boards of Officers, para. l-5(a) (2 Oct. 
2006) ("An administrative fact-finding procedure under this regulation may be designated an 



investigation or a board of officers.") (AR 15-6). Nevertheless, administrative actions are 
considered separate from criminal investigations 1 because they serve distinct purposes. United 
States v. Turner, 33 MJ. 40, 41 (stating that administrative inspections determine the fitness and 
readiness of a unit and are therefore unlike searches for evidence as part of the criminal justice 
process). Similarly, the results stemming from the investigation also distinguish criminal and 
administrative investigations. United States v. Bickel, 30 M.J. 277, 285 (C.M.A. 1990) 
(differentiating between actions that result in admonitions or adverse administrative actions and 
those resulting in criminal prosecution). Despite these differences, similar to a judicial 
proceeding's verdict, administrative investigations make recommendations based upon the facts 
of the investigation. See AR 15-6 para. 3-11 ("Each recommendation, even a negative one . . . 
must be consistent with the findings.")- 

Army and Department of Defense (DOD) regulations also discuss investigations in terms 
of locating relevant facts and persons responsible for compromised or lost classified information. 
See U.S. Dep 't of Army Reg. 380-5, Department of the Army Information Security Program, 
para. 10-l(a) (29 Sept. 2000) (AR 380-5); Dep't of Defense Regulation 5200.1-r, Information 
Security Program, 10-1 00(a) (Jan. 1997) (DOD 5200.1-r); see also U.S. Dep 7 of Army Reg. 381- 
20, The Army Counterintelligence Program, para. 4-2 (15 Nov. 1993). AR 380-5 and DOD 
5200.1-r investigations are both search oriented-they operate to determine who contributed to 
losing or compromising classified information and fact finding related thereto. See AR 380-5 
para. 10-l(a)(l)-(2) (requiring the investigation to determine whether the classified information 
was compromised and what persons, situations, and/or conditions contributed to the incident); 
DOD 5200.1-r 10-100(b)-(c). To meet the regulatory goals of limited scope, investigations 
under AR 380-5 and DOD 5200. 1-r must be conducted promptly to ensure results are reported 
promptly. See AR 380-5 para. 10-1 (a); DOD 5200.1-r 10-100(a). Moreover, investigations 
under AR 380-5 do not foreclose separate actions relating to the same incident. See AR 380-5 
para. 10- 1(b). 

Damage assessments can relate to the same incident as an investigation; however, 
damage assessments are distinct from investigations because they are strategic, long-term 
analyses and not fact finding or criminal endeavors. See, e.g., AR 380-5 para. 10-5(f); but see 
United States v. Lonetree, 35 M.J. 396, 403 (C.M.A. 1992). Damage assessments remain 
separate and distinct from classification reviews, which are performed in support of a 
prosecution, and from damage control, which is performed immediately after the discovery or 
disclosure of the compromise of classified information. See Dep 7 of Defense Instruction 
5240.11, Damage Assessments, Encl. 2 para. E2.1.4 (23 Dec. 1991) (DOD 5240.11). 



Although, administrative investigations are distinct from criminal investigations because they are fact finding 
rather than judicial proceedings, administrative investigations can transition into criminal ones based on the results 
of the investigation. United States v. Cohen, 63 M.J. 45, 51-52 (C.A.A.F. 2006) (noting that instruction 
contemplated the possibility that the investigation could transition into a criminal one from an administrative one). 

2 In dicta, Lonetree refers to a damage assessment as a "damage-assessment investigation." Lonetree, 35 M.J. at 
403. However, the Lonetree held the damage assessment was not a criminal investigation for purposes of 
determining whether the accused was entitled to an Article 3 1(b) warning because it was not coordinated with the 
military criminal investigation. Id. at 404. Also, the court uses the term "damage assessment" to refer to a series of 
interviews with a single person, the accused, and this usage is inconsistent with the manner in which the term is used 
in the case against the accused and in the cited laws and regulations. 
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Additionally, regulations treat damage assessments separately from investigations because the 
two are considered separately in different sections of Army and DOD regulations. Compare AR 
380-5 para. 10-1 with AR 380-5 para. 10-5; and compare DOD 5200. 1-r 10-100 with DOD 
5200. 1-r 10-104 (directing the reader to complete a damage assessment in accordance with DOD 



Specifically, damage assessments are "a long-term, multi-disciplinary analysis of 
adverse effects of the compromise on systems, plans, operations, and/or intelligence." AR 380-5 
para. 10-5(f). Accordingly, the Counterintelligence Enhancement Act of 2002 (CI Enhancement 
Act) labels damage assessments "strategic analyses" and not "investigations." 
Counterintelligence Enhancement Act of 2002, 50 U.S.C. § 402c(d)(4). The CI Enhancement 
Act additionally authorizes the Office of the National Counterintelligence Executive (NCIX) to 
conduct damage assessments but prohibits it from carrying out investigations. See id. at § 
402c(d)(4), (6) (prohibiting NCIX from conducting counterintelligence investigations or 
operations). Unlike the rapid response of damage control, damage assessments are typically 
conducted post-prosecution. Id. (stating the that damage assessments should be conducted after 
a prosecution unless special circumstances necessitate a pre-prosecution assessment). 
Conducting damage assessments post-prosecution comports with the time requirements required 
to determine in great detail the practical effects of a compromise on operations, systems, 
materials, and intelligence. See id. Upon completion, the analyses of intelligence systems in a 
damage assessment are delivered to security decision-makers. See Office of the National 
Counterintelligence Executive, The National Counterintelligence Strategy of the United States at 
10 (Mar. 2005). Ultimately, the opinions presented in the damage assessments shape future 
intelligence policy at a national level. See id. 



Based on the above, the United States submits that the term "investigation" does not 
include damage assessments. Whereas investigations pursue facts and conclusions based 
thereon, damage assessments look at the strategic effects of lost or stolen classified information. 
Damage assessments are conducted without an eye toward prosecution, unlike criminal 
prosecutions, or without a strict fact finding purpose, unlike administrative investigations. 
Employing multiple disciplines and multiple agencies, damage assessments expansively analyze 
more than facts — they analyze systems, operations and plans. Significantly, the theories damage 
assessments dictate policy. Contrastingly, investigations simply determine details to reach 
factual conclusions. 



5240.11). 



CONCLUSION 
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